medium10 pts · first answer countsidentity-securitywindows-event-logsprivileged-access
Alert on new Domain Admins
You want an alert whenever someone is added to Domain Admins (a global group) or Enterprise Admins (a universal group). Which Security event IDs cover these?
Discussion 0
Join free to post in the discussion.
Related questions
- Which login is really two-factor?Cybersecurity Analyst
- Why passwords are saltedCybersecurity Analyst
- What is Windows Event ID 4624?Cybersecurity Analyst
- What is Sysmon Event ID 1?Cybersecurity Analyst
- Brute force or password spraying?Cybersecurity Analyst
- Windows event for an account lockoutCybersecurity Analyst
- Windows event for a new serviceCybersecurity Analyst
- Missing command lines in 4688Cybersecurity Analyst